Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
8 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
In Apache PDFBox 1.8.0 to 1.8.14 and 2.0.0RC1 to 2.0.10, a carefully crafted (or fuzzed) file can trigger an infinite loop which leads to an out of memory exception in Apache PDFBox's AFMParser.
Recommended action: Upgrade to 2.0.11 or 1.8.15 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
A carefully crafted PDF file can trigger an infinite loop while loading the file. This issue affects Apache PDFBox version 2.0.22 and prior 2.0.x versions.
Recommended action: Upgrade to 2.0.23 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
In Apache PDFBox, a carefully crafted PDF file can trigger an OutOfMemory-Exception while loading the file. This issue affects Apache PDFBox version 2.0.23 and prior 2.0.x versions.
Recommended action: Upgrade to 2.0.24 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
In Apache PDFBox, a carefully crafted PDF file can trigger an infinite loop while loading the file. This issue affects Apache PDFBox version 2.0.23 and prior 2.0.x versions.
Recommended action: Upgrade to 2.0.24 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
A carefully crafted PDF file can trigger an OutOfMemory-Exception while loading the file. This issue affects Apache PDFBox version 2.0.22 and prior 2.0.x versions.
Recommended action: Upgrade to 2.0.23 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Apache PDFBox 2.0.14 does not properly initialize the XML parser, which allows context-dependent attackers to conduct XML External Entity (XXE) attacks via a crafted XFDF.
Recommended action: Upgrade to 2.0.15 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
In Apache PDFBox 1.8.0 to 1.8.15 and 2.0.0RC1 to 2.0.11, a carefully crafted PDF file can trigger an extremely long running computation when parsing the page tree.
Recommended action: Upgrade to 2.0.12 or 1.8.16 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Apache PDFBox before 1.8.12 and 2.x before 2.0.1 does not properly initialize the XML parsers, which allows context-dependent attackers to conduct XML External Entity (XXE) attacks via a crafted PDF.
Recommended action: Upgrade to 2.0.1 or 1.8.12 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.